10.11 Linux网络相关
ifconfig查看网卡的ip，需要安装net-tools包。
也可以使用ip addr命令。
-a display all interfaces which are currently available, even if down关闭网卡和打开网卡操作使用
ifdown和ifup命令，都是后加网卡名。
比如我们想单独对于一个网卡进行更改，又不想重启所有的网卡，只启动指定的网卡，就是用这两个命令。
但是我想通过xshell等软件链接一个远程主机，那么当我们更改好配置文件后，可以使用如下命令重启网卡。
[root@localhost: ~]# ifdown ens33 && ifconfig && ifup ens33
Device 'ens33' successfully disconnected.
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 00:0c:29:1c:de:be txqueuelen 1000 (Ethernet)
RX packets 19061 bytes 18148597 (17.3 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 13666 bytes 3060590 (2.9 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 72 bytes 6264 (6.1 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 72 bytes 6264 (6.1 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
可以看到已经没有ip地址了。
设定一个虚拟网卡，给虚拟网卡设置ip。
[root@localhost: ~]# cd /etc/sysconfig/network-scripts/
[root@localhost: network-scripts]# ls
ifcfg-ens33 ifdown-eth ifdown-post ifdown-Team ifup-aliases ifup-ipv6 ifup-post ifup-Team init.ipv6-global
ifcfg-lo ifdown-ippp ifdown-ppp ifdown-TeamPort ifup-bnep ifup-isdn ifup-ppp ifup-TeamPort network-functions
ifdown ifdown-ipv6 ifdown-routes ifdown-tunnel ifup-eth ifup-plip ifup-routes ifup-tunnel network-functions-ipv6
ifdown-bnep ifdown-isdn ifdown-sit ifup ifup-ippp ifup-plusb ifup-sit ifup-wireless
[root@localhost: network-scripts]# cp ifcfg-ens33{,\:0}
[root@localhost: network-scripts]# ls
ifcfg-ens33 ifdown-bnep ifdown-isdn ifdown-sit ifup ifup-ippp ifup-plusb ifup-sit ifup-wireless
ifcfg-ens33:0 ifdown-eth ifdown-post ifdown-Team ifup-aliases ifup-ipv6 ifup-post ifup-Team init.ipv6-global
ifcfg-lo ifdown-ippp ifdown-ppp ifdown-TeamPort ifup-bnep ifup-isdn ifup-ppp ifup-TeamPort network-functions
ifdown ifdown-ipv6 ifdown-routes ifdown-tunnel ifup-eth ifup-plip ifup-routes ifup-tunnel network-functions-ipv6
[root@localhost: network-scripts]# vim ifcfg-ens33\:0 更改了NAME DEVICE IPADDR
[root@localhost: network-scripts]# !vim
vim ifcfg-ens33\:0
[root@localhost: network-scripts]# ifdown ens33 && ifup ens33
Device 'ens33' successfully disconnected.
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/6)
[root@localhost: network-scripts]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.16.100 netmask 255.255.255.0 broadcast 192.168.16.255
inet6 fe80::4f75:15d9:faa2:c641 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:1c:de:be txqueuelen 1000 (Ethernet)
RX packets 19633 bytes 18198795 (17.3 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 14085 bytes 3132446 (2.9 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens33:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.16.150 netmask 255.255.255.0 broadcast 192.168.16.255
ether 00:0c:29:1c:de:be txqueuelen 1000 (Ethernet)
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 88 bytes 7656 (7.4 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 88 bytes 7656 (7.4 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
这样192.168.16.150也是可以ping通的。
下列命令可以查看是否是link ok的网卡，查看是否连接网线。
[root@localhost: network-scripts]# mii-tool ens33
ens33: negotiated 1000baseT-FD flow-control, link ok
[root@localhost: network-scripts]# ethtool ens33
Settings for ens33:
Supported ports: [ TP ]
Supported link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Supported pause frame use: No
Supports auto-negotiation: Yes
Advertised link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Advertised pause frame use: No
Advertised auto-negotiation: Yes
Speed: 1000Mb/s
Duplex: Full
Port: Twisted Pair
PHYAD: 0
Transceiver: internal
Auto-negotiation: on
MDI-X: off (auto)
Supports Wake-on: d
Wake-on: d
Current message level: 0x00000007 (7)
drv probe link
Link detected: yes更改主机名，
[root@localhost: ~]#
[root@localhost: ~]# hostnamectl set-hostname lhy
[root@localhost: ~]# hostname
lhy
[root@localhost: ~]# bash
[root@lhy: ~]# cat /etc/hostname
lhy
[root@lhy: ~]# echo "localhost" > /etc/hostname
[root@lhy: ~]# bash
[root@lhy: ~]# hostname
lhy
[root@lhy: ~]# cat /etc/hostname
localhost
DNS的配置文件在/etc/resolv.conf中，是在网卡配置文件中定义的。
[root@localhost: ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 8.8.8.8
[root@localhost: ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens33 | grep 'DNS'
DNS1="8.8.8.8"/etc/hosts配置文件，在linux和windows中都有，可以说就是一个简单的dns，支持一个ip配多个域名（空格分隔），只在本机生效。如果是多个域名配多个ip，以最后一个为准。的
[root@localhost: ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain610.12 firewalld和netfilter
linux下的防火墙selinux
临时关闭可以用setenforce 0
[root@localhost: ~]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of three two values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
今天我们来介绍另外一种防火墙，netfilter和firewalld。这是在centos6，7中的防火墙。
selinux一般是关闭的。
firewalld关闭方法。
[root@localhost: ~]# systemctl disable firewalld
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@localhost: ~]# systemctl stop firewalld.service开启netfilter需要先安装iptables-service
[root@localhost: ~]# yum install iptables-services.x86_64
.............
[root@localhost: ~]# systemctl enable iptables
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
[root@localhost: ~]# systemctl start iptables.service可以简单看一下
[root@localhost: ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
26 1716 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 14 packets, 1448 bytes)
pkts bytes target prot opt in out source destination 这样我们就开启了centos6上的防火墙。
之后我们再来介绍firewalld。
10.13 netfilter5表5链介绍
filter:
This is the default table (if no -t option is passed). It contains the built-in chains INPUT (for packets destined to local sockets), FORWARD (for packets being routed through the box), and OUTPUT (for locally-generated packets).
nat:
This table is consulted when a packet that creates a new connection is encountered. It consists of three built-ins: PREROUTING (for altering packets as soon as they come in), OUTPUT (for altering locally-generated packets before routing), and POSTROUTING (for altering packets as they are about to go out). IPv6 NAT support is available since kernel 3.7.
mangle:
This table is used for specialized packet alteration. Until kernel 2.4.17 it had two built-in chains: PREROUTING (for altering incoming packets before routing) and OUTPUT (for altering locally-generated packets before routing). Since kernel 2.4.18, three other built-in chains are also supported: INPUT (for packets coming into the box itself), FORWARD (for altering packets being routed through the box), and POSTROUTING (for altering packets as they are about to go out).
raw:
This table is used mainly for configuring exemptions from connection tracking in combination with the NOTRACK target. It registers at the net‐filter hooks with higher priority and is thus called before ip_conntrack, or any other IP tables. It provides the following built-in chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets generated by local processes)
security:
This table is used for Mandatory Access Control (MAC) networking rules, such as those enabled by the SECMARK and CONNSECMARK targets. Mandatory Access Control is implemented by Linux Security Modules such as SELinux. The security table is called after the filter table, allowing any Dis‐cretionary Access Control (DAC) rules in the filter table to take effect before MAC rules. This table provides the following built-in chains: INPUT (for packets coming into the box itself), OUTPUT (for altering locally-generated packets before routing), and FORWARD (for altering packets being routed through the box).filter可以限制输入输出，做到转发数据包等许多的功能。
路由器的实现可以由nat实现。A机器网卡a连接公网ip；B机器网卡b1也链接公网ip，但是B还有一个网卡b2连接私网；C机器c网卡连接相同的私网。那么A和C是不能直接通信的。只有ab1通信，b2和c通信，这时候在B机器设置一个nat的iptables规则，做一个端口映射，从B的port1映射到D的port2。这样就可以通信了。
这五个表我们只介绍前两个。
filter表过滤数据包最常用的表有INPUT、FORWARD、OUTPUT三个链。
nat有三个表PREROUTING、OUTPUT、POSTROUTING。
10.14 iptables语法
[root@localhost: ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
26 1716 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 14 packets, 1448 bytes)
pkts bytes target prot opt in out source destination 这些是iptables的默认规则，保存在/etc/sysconfig/iptables中。
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT我们可以使用-F清空所有规则，但是是不保存的。
[root@localhost: ~]# iptables -F
[root@localhost: ~]# iptables -nvL
Chain INPUT (policy ACCEPT 26 packets, 1716 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 14 packets, 1400 bytes)
pkts bytes target prot opt in out source destination如果想把我们当前规则保存下来，使用命令
[root@localhost: ~]# service iptables save我们默认操作的是filter表，-t选项指定表。
[root@localhost: ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination-Z选项清空计数器
[root@localhost: ~]# iptables -nvL
Chain INPUT (policy ACCEPT 24 packets, 1584 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 15 packets, 1884 bytes)
pkts bytes target prot opt in out source destination
[root@localhost: ~]# iptables -Z
[root@localhost: ~]# iptables -nvL
Chain INPUT (policy ACCEPT 6 packets, 428 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 4 packets, 480 bytes)
pkts bytes target prot opt in out source destination对于命令
[root@localhost: ~]# iptables -t filter -A INPUT -s 192.168.16.1 -p tcp --sport 1234 -d 192.168.16.100 --dport 80 -j DROP把来源于192.168.16.1的tcp的端口为1234目标主机192.168.16.100端口80的数据包全部丢掉。
[root@localhost: ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
277 18344 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
0 0 DROP tcp -- * * 192.168.16.1 192.168.16.100 tcp spt:1234 dpt:80可以看到新加的规则放在了最后。
也可以-I插入规则，而-A是追加规则。
[root@localhost: ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
553 43744 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
0 0 DROP tcp -- * * 192.168.16.1 192.168.16.100 tcp spt:1234 dpt:80匹配规则的时候，匹配第一次符合条件的规则直接执行。
-D可以删除规则。
[root@localhost: ~]# iptables -t filter -D INPUT -p tcp --dport 80 -j DROP
[root@localhost: ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
614 49012 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
0 0 DROP tcp -- * * 192.168.16.1 192.168.16.100 tcp spt:1234 dpt:80
删除可以根据number号删除。
[root@localhost: ~]# iptables -nvL --line-number
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
2 696 54488 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
4 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
5 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
6 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
7 0 0 DROP tcp -- * * 192.168.16.1 192.168.16.100 tcp spt:1234 dpt:80
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 36 packets, 4848 bytes)
num pkts bytes target prot opt in out source destination
[root@localhost: ~]# iptables -nvL -D INPUT 7
iptables v1.4.21: Cannot use -D with -L
Try `iptables -h' or 'iptables --help' for more information.
[root@localhost: ~]# iptables -D INPUT 7
[root@localhost: ~]# iptables -nvL --line-number
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
2 798 62292 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
4 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
5 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
6 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 5 packets, 668 bytes)
num pkts bytes target prot opt in out source destination -P是默认规则，即没有规则的表由默认规则来解释。
默认策略是ACCEPT
[root@localhost: ~]# iptables -P OUTPUT DROP##试验机实验的时候把默认的规则变成DROP会断开你的xshell链接。
扫一扫
3562
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
